Storage system and storage control method

ABSTRACT

Provided are a storage system and a storage control method wherein, when communication is disabled (communication via a data communication path is disabled) in spite of replacement of a second CTL among a first CTL and the second CTL that are redundant storage controllers and that are coupled via the data communication path, the first CTL executes a write process of writing dirty data and data management information to one or more storage devices while maintaining acceptance of I/O requests from a host. The replaced second CTL reads the data management information from the one or more storage devices. The first CTL stops accepting I/O requests from the host. The replaced second CTL starts accepting I/O requests from the host.

TECHNICAL FIELD

The present invention generally relates to storage control of a storagesystem having redundant storage controllers.

BACKGROUND ART

A storage system generally has one or more storage devices (typically, aRAID (Redundant Array of Independent (or Inexpensive) Disks) groupconstituted by a plurality of storage devices) and a storage controller(hereinafter, a CTL) which executes I/O (Input/Output) of data withrespect to the one or more storage devices in response to an I/O requestfrom a host. The CTL is made redundant in order to ensure reliability(for example, PTL 1).

CITATION LIST Patent Literature

PTL 1: WO 2016/088231

SUMMARY OF INVENTION Technical Problem

The redundant CTLs include first and second CTLs. Each CTL has an ownmemory. CTLs share information in memories between the CTLs and aninter-CTL synchronization process is executed between the CTLs. Thesynchronization process includes at least any one of inter-CTLcommunication of cached data (dirty data) in accordance with a writerequest received from the host and inter-CTL communication of managementinformation (at least an updated portion thereof) which has been updatedin accordance with the write request.

The CTLs are linked to each other by a data communication path. Theinter-CTL communication for the synchronization process is performed viathe data communication path.

Therefore, when communication via the data communication path isdisabled (hereinafter, such a state is referred to as a“communication-disabled” state), the synchronization process between theCTLs is disabled (hereinafter, such a state is referred to as a“synchronization-disabled” state). With a storage system of which asystem shutdown is desirably avoided to the greatest extent possible(for example, a storage system that is desirably operational 24 hours aday for 365 days a year), it is not desirable to suspend acceptance ofI/O requests from a host because the CTLs are in asynchronization-disabled state.

However, when each CTL operates independently under asynchronization-disabled state, the system enters a state of a so-calledsplit brain and problems such as loss of data inside a storage devicemay occur.

Therefore, when the CTLs are in a synchronization-disabled state, it isnecessary to block one of the first and second CTLs and to continueoperation by a single CTL.

Identification of a cause of a communication-disabled is not alwayspossible. Thus, a method is always adopted in which the second CTL (apredetermined CTL) is blocked and replaced when the CTLS are in acommunication-disabled state.

However, there may be cases where the CTLS become in acommunication-disabled state by a failure of the first CTL (for example,a failure of a port to which the data communication path is coupled).Replacing the second CTL when the first CTL is in a failed state onlyresults in an occurrence of a communication-disabled state and blockageof the second CTL. In this case, the first CTL may be replaced. However,it is unfortunately necessary to shut down the storage system forreplacing the first CTL.

Solution to Problem

When a communication-disabled state (a state where communication via thedata communication path is disabled) occurs even when the second CTL isreplaced, the first CTL executes a write process of writing dirty dataand data management information to one or more storage devices whilemaintaining acceptance of I/O requests from a host. The replaced secondCTL reads the data management information from the one or more storagedevices. The first CTL stops accepting I/O requests from the host. Thereplaced second CTL starts accepting I/O requests from the host.

Advantageous Effects of Invention

Even when it is a mistake to block the second CTL (a predetermined CTL),the first CTL (a CTL that is likely to be a failed CTL) can be blockedand replaced without shutting down the storage system.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 shows a configuration of a computer system according to anembodiment.

FIG. 2 shows respective configurations of role management informationand data management information.

FIG. 3 shows a part of a flow of process that is executed when first andsecond communication-disabled states occur.

FIG. 4 shows a remainder of the flow of process that is executed whenfirst and second communication-disabled states occur.

FIG. 5 shows an example of a screen displayed by a management systemwhen a second communication-disabled state occurs.

DESCRIPTION OF EMBODIMENTS

Hereinafter, an embodiment will be described with reference to thedrawings. In the following description, when describing elements of anidentical or similar type without distinguishing the elements from oneanother, a common sign of reference signs may be used, but whendescribing elements of an identical or similar type by distinguishingthe elements from one another, reference signs may be used. For example,when CTLs (storage controllers) are referred without distinguishing themfrom one another, the CTLs may be referred to as a “CTL 60”, but whenthe CTLs are referred with distinguishing them from one another, theCTLs may be referred to as a “CTL 60A”, a “CTL 60B”, and the like. Inaddition, a symbol “A” will be used as a suffix of reference signsattached to components in the CTL 60A and a symbol “B” will be used as asuffix of reference signs attached to components in the CTL 60B.

Furthermore, in the following description, to “accept an I/O request”means a state where an I/O request is receivable and does not necessarymean that an I/O request has actually been received.

FIG. 1 shows a configuration of a computer system according to anembodiment.

A computer system 50 includes a host storage system 52 and a managementsystem 54. The host storage system 52 includes a plurality of hosts 101and a storage system 103 coupled to the plurality of hosts 101. Themanagement system 54 manages the storage system 103. The plurality ofhosts 101 and the storage system 103 are coupled to each other via afirst communication network such as a SAN (Storage Area Network) 102.The management system 54 and the storage system 103 are coupled to eachother via a second communication network such as a LAN (Local AreaNetwork). The first and second communication networks may be a samecommunication network. A relay device such as a PCIe (PCI-Express)switch or a multiplexor may be adopted in place of at least one of thefirst and second communication networks. There may be only one host 101.The host 101 is constituted by one or more host computers.

The storage system 103 includes: a plurality of storage devices 131; andredundant CTLs 60A and 60B which are coupled to the plurality of storagedevices 131. The CTLs 60A and 60B are linked to each other by a datacommunication path 143 and a command communication path 144. There maybe only one storage device 131.

For example, an outline of the present embodiment is as follows.

The CTL 60A is a master and the CTL 60B is a slave. When a firstcommunication-disabled state occurs in which communication via the datacommunication path 143 is disabled, the CTL 60B (slave) is blocked andreplaced. When a second communication-disabled state occurs in whichcommunication via the data communication path 143 is disabled even afterthe CTL 60B is blocked and replaced (that is, whencommunication-disabled state is not resolved) or, in other words, when aselection of an CTL to be a block target was wrong (when a blockselection error is detected), the replaced CTL 60B enters a hot standbymode while the CTL 60A enters a write through mode after confirming thatthe CTL 60B has entered the hot standby mode.

When the replaced CTL 60B enters the hot standby mode, the CTL 60Bexecutes a preparation process including initial configuration foraccepting I/O requests from the host 101.

When the CTL 60A enters the write through mode, the CTL 60A executes awrite process of writing data management information 175 and dirty data(data that has been cached in a memory 161A but has not been writteninto the storage device 131) held by the CTL 60A into the storage device131 while maintaining acceptance of I/O requests from the host 101.

The replaced CTL 60B reads the data management information from thestorage device 131 to a memory 161B.

The CTL 60A exits the write through mode and stops accepting I/Orequests from the host 101. The replaced CTL 60B starts accepting I/Orequests from the host 101.

When the second communication-disabled state occurs, the data managementinformation 175 is synchronized between the CTLs 60A and 60B via thestorage device 131. Once the synchronization is completed and the CTL60B starts accepting I/O requests, the CTL 60A is blocked (replacementof the CTL 60A is enabled).

According to the present embodiment, even when a block selection erroroccurs, the CTL 60A (the CTL that is likely to be a failed CTL) can bereplaced without having to shut down the storage system 103.

Hereinafter, the present embodiment will be described in detail.

The host 101 transmits an I/O request of data (user data) to the storagesystem 103. User data refers to data stored by the host 101 in a logicalvolume. The I/O request includes I/O destination informationrepresenting an area of an I/O destination. The I/O destinationinformation includes, for example, a LUN (Logical Unit Number) of alogical volume that is the I/O destination and an LBA (Logical BlockAddress) of an area in the logical volume. The logical volume isprovided by the CTLs 60A and 60B.

A storage device 131 is a non-volatile storage device (for example, anHDD (Hard Disk Drive) or an SSD (Solid State Drive)).

The CTL 60 includes an F-I/F (a front end interface) 142, a B-I/F (aback end interface), an M-I/F (a management interface) 141, a memory161, and a processor 121 connected to these components.

The F-I/F 142 is an interface device coupled to the plurality of hosts101. The B-I/F 123 is an interface device coupled to the plurality ofstorage devices 131. The M-I/F 141 is an interface device coupled to themanagement system 54.

The memory 161 stores a control program 171, role management information173, and data management information 175. The control program 171 isexecuted by the processor 121 and controls operations of the CTL 60. Therole management information 173 is information indicating a role (amaster or a slave) of each of the CTLs 60A and 60B. The data managementinformation 175 is information related to data in accordance with awrite request received by the CTL 60.

The CTLs 60A and 60B (for example, processors 121A and 121B) are linkedto each other by the data communication path 143. In addition, the CTLs60A and 60B (for example, the processors 121A and 121B) are linked toeach other by the command communication path 144.

The management system 54 is constituted by one or more computers. Forexample, when a management computer displays information (specifically,when a management computer displays information on its own displaydevice or when a management computer transmits information to bedisplayed to a remote display computer), the management computerconstitutes the management system 54. In addition, for example, whenfunctions identical or similar to those of a management computer arerealized by a plurality of computers, the plurality of computers (when adisplay computer performs display, the display computer may be includedtherein) constitute the management system 54. Input of information tothe computer and output of information from the computer may beperformed by an input/output device included in the computer. While adisplay device, a keyboard, and a pointing device are conceivable asexamples of the input/output device, other devices may be adopted inplace of at least one of these devices or in addition to these devices.In addition, a serial interface device or an Ethernet input/outputdevice (Ethernet is a registered trademark) may be adopted as analternative to the input/output device, in which case output (forexample, display) and input of information may be performed by couplinga display computer including a display device, a keyboard, and apointing device to such an interface device and by having a computertransmit information to be displayed to the display computer and havingthe computer receive information to be input from the display computer.

FIG. 2 shows respective configurations of the role managementinformation 173 and the data management information 175.

The role management information 173 has an entry for each CTL 60 andeach entry holds information such as a CTL ID 201 and a role 202. TheCTL ID 201 is an ID of the CTL 60. The role 202 indicates a role of theCTL 60. According to the present embodiment, prior to an occurrence ofthe second communication-disabled state, the CTL 60A (CTL ID 201 “CTL1”)is a master and the CTL 60B (CTL ID 201 “CTL2”) is a slave.

The data management information 175 has an entry for each piece of data(user data). Each entry holds information such as a data ID 211 and adata attribute 212. The data ID 121 is an ID of a piece of data (userdata). The data attribute 212 includes information related to anattribute of the piece of data such as a storage area address (forexample, an ID of the storage device 131 and an address of a storagearea in the storage device 131) of the piece of data. The data attribute212 may further include at least one of a volume area address (forexample, an address of an area in a logical volume) of the piece ofdata, a cache attribute (for example, dirty (the piece of data is notstored in the storage device 131) or clean (the data piece of is storedin the storage device 131)) of the piece of data, and a cache areaaddress (for example, an address of an area of the piece of data in thememory 161) of the piece of data.

Hereinafter, an example of processes performed in the present embodimentwill be described.

FIGS. 3 and 4 show a flow of the processes that are executed when thefirst and second communication-disabled states occurs. In the followingdescription, a process of the CTL 60A is a process that is performed by,for example, the processor 121A executing a control program 171A. Inaddition, a process of the CTL 60B is a process that is performed by,for example, the processor 121B executing a control program 171B.

When a first communication-disabled state occurs in which communicationvia the data communication path 143 is disabled (S301: Y), the CTL 60Aexecutes a block process of the first communication-disabled state (forexample, a process of shutting down modules (for example, the F-I/F 142Aand the B-I/F 123A) coupled to the processor 121A)) (S302). And then theCTL 60A transmits a block command (an example of a first signal) to theCTL 60B via the command communication path 144 (S303). S302 and S303 areexecuted by the CTL 60A because the CTL 60A is the master. The CTL 60Breceives the block command via the command communication path 144 (S304)and blocks itself in response to the block command (S305). In addition,the management system 54 may be notified of the occurrence of the firstcommunication-disabled state from the CTL 60A (or 60B) and the CTL 60Bmay receive a block command from the management system 54 havingreceived the notification. Both the CTLs 60A and 60B accept I/O requestsfrom the host 101 until the CTL 60B receives the block command, but onlythe CTL 60A accepts I/O requests from the host 101 after the CTL 60Breceives the block command. Once the CTL 60B is blocked, the CTL 60Btransmits a block completion notification to the CTL 60A via the commandcommunication path 144 (S306).

The CTL 60A receives the block completion notification via the commandcommunication path 144 (S307) and transmits a block completion messageto the management system 54 via the M-I/F 141A (S308). The managementsystem 54 receives the block completion message and displays contents ofthe message (S309). A maintenance person checks the message contents(S310) and determines whether or not to perform a shutdown-lessreplacement of the CTL 60B (S311). A “shutdown-less replacement” refersto replacing the CTL 60 without shutting down the storage system 103 (ina state where the storage system 103 remains operational). When adetermination result of S311 is false, the maintenance person performs ashutdown replacement of the CTL 60B. A “shutdown replacement” refers toreplacing the CTL 60 after shutting down the storage system 103.

When the determination result of S311 is true, the maintenance personperforms a shutdown-less replacement of the CTL 60B and, transmits acompletion notification to at least one of the CTL 60A and the replacedCTL 60B via the management system 54 (S312). When one of the CTL 60A andthe replaced CTL 60B receives the completion notification, thecompletion notification is shared between the CTLs 60A and 60B via thecommand communication path 144.

The CTL 60A and the replaced CTL 60B receive the completion notificationand execute a recovery process. In the recovery process, for example,(1) to (4) below are performed.

(1) The processor 121B in the CTL 60B starts and initializes the CTL60B.(2) The processor 121B diagnoses whether or not modules in the CTL 60Bare normal.(3) When the modules in the CTL 60B are normal, the processor 121Bperforms, with the processor 121A in the CTL 60A, initial configurationwith respect to inter-CTL communication.(4) The processor 121B performs, with the processor 121A in the CTL 60A,a synchronization process of the data management information 175.

When a second communication-disabled state occurs in which communicationvia the data communication path 143 is disabled even after the CTL 60Bis replaced (S314: Y) or, in other words, when a block selection erroroccurs, a process shown in FIG. 4 is executed. When the storage system103 is not restored to normal even though the secondcommunication-disabled state does not occur (S315: N), S303 is executedonce again. When the storage system 103 is restored to normal (S315: N),the process returns to S301.

When a block selection error occurs, as shown in FIG. 4, the CTL 60Aexecutes a block process of the second communication-disabled state(S400). The CTL 60A transmits a confirmation message including aninquiry as to whether or not a shutdown-less replacement of the CTL 60Ais to be performed to the management system 54 (S401). The managementsystem 54 receives the confirmation message and displays theconfirmation message (S402). FIG. 5 shows an example of a display screenof the confirmation message. The maintenance person checks theconfirmation message (S403) and determines whether or not to perform ashutdown-less replacement of the CTL 60A (S404). When a determinationresult of S404 is false, the maintenance person performs a shutdownreplacement of the CTL 60A (S406). S406 is performed when, for example,a “cancel” button on the display screen exemplified in FIG. 5 ispressed.

When the determination result of S404 is true, a performance message (anexample of a third signal) including information describing that ashutdown-less replacement of the CTL 60A is to be performed istransmitted to at least one of the CTL 60A and the replaced CTL 60B viathe management system 54 (S405). S405 is performed when, for example, a“start” button on the display screen exemplified in FIG. 5 is pressed.When one of the CTL 60A and the replaced CTL 60B receives theperformance message, the performance message is shared between the CTLs60A and 60B via the command communication path 144.

The CTL 60A and the replaced CTL 60B receive the performance message(S407), and the CTL 60B enters the hot standby mode. Specifically, theCTL 60B starts a preparation process including initial configuration foraccepting I/O requests from the host (S408). Alternatively, S408 may bestarted after S400 by skipping S401 to S407. In other words, S408 may bestarted without a manual instruction from the maintenance person. TheCTL 60B completes the preparation process (S409) and transmits acompletion notification to at least the CTL 60A among the managementsystem 54 and the CTL 60A. The management system 54 having received thecompletion notification displays a completion notification message(S411).

The replaced CTL 60B completing the preparation process means that onceinheritance from the CTL 60A to the CTL 60B is completed, the CTL 60Bbecomes capable of accepting I/O requests. In consideration thereof, theCTL 60A having received the completion notification (in other words, theCTL 60A having confirmed that the CTL 60B has entered the hot standbymode) enters the write through mode or, in other words, the CTL 60Ahaving received the completion notification starts a write process ofwriting dirty data and data management information in the memory 161Ainto one or more storage devices 131 while maintaining acceptance of I/Orequests from the host 101 (S412). An address of a storage area that isa write destination of the data management information may be determinedin advance. The CTL 60A transmits a write process start notification (anexample of a second signal) to the CTL 60B via the command communicationpath 144 (S413). The CTL 60B receives the write process startnotification (an example of a second signal) via the commandcommunication path 144 (S414). The write process start notification maydesignate an address of a storage area that is a write destination ofthe data management information. When the CTL 60B receives the writeprocess start notification, the CTL 60B reads the data managementinformation from the one or more storage devices 131 and starts aninheritance process (for example, inheritance of information related toa blocked storage device 131) (S415). Reading the data managementinformation from the one or more storage devices 131 may or may not beincluded in the inheritance process.

In the write through mode, when the CTL 60A receives a write requestfrom the host 101, the CTL 60A writes data in accordance with the writerequest into one or more storage devices 131 and, updates the datamanagement information in the one or more storage devices 131 inaccordance with the writing of the data and subsequently responds to thehost 101 with a write completion. In this manner, when the CTL 60Areceives a write request in the write through mode, a response isreturned after writing data in accordance with the write request and anupdate of the data management information are executed with respect toone or more storage devices 131. Accordingly, it is expected thataccuracy of inheritance of the data management information to the CTL60B can be guaranteed.

When the CTL 60A completes the write process, the CTL 60A transmits awrite process completion notification (an example of a fourth signal) tothe CTL 60B via the command communication path 144 (S416). The CTL 60Astops acceptance of I/O requests (S417). In doing so, the CTL 60Achanges the role of the CTL 60A from a master to a slave (updates therole management information 173).

The CTL 60B receives the write process completion notification via thecommand communication path 144 or, in other words, the CTL 60B completesthe inheritance process (S418). In this case, the CTL 60B startsacceptance of I/O requests (S419). In doing so, the CTL 60B changes therole of the CTL 60B from a slave to a master (updates the rolemanagement information 173). In addition, the CTL 60B transmits anotification of the start of I/O acceptance by the CTL 60B to themanagement system 54. The management system 54 having received thenotification displays a message including information indicating thatthe CTL 60B has started I/O acceptance (S420). Since the CTL 60B becomesa master in S419, subsequently, when communication-disabled state occursafter the CTL 60A is replaced, the CTL 60B is capable of blocking theCTL 60A. The CTL 60B becomes a master on a temporary basis and, afterthe CTL 60A is replaced, the CTL 60A may become a master and the CTL 60Bmay be restored to a slave.

The CTL 60A accepts I/O requests until S416 and S418, and the CTL 60Baccepts I/O requests on behalf of the CTL 60A from S417 and S419. Thestopping of I/O request acceptance of S417 maintains conformance betweenthe data management information read by the CTL 60B to the memory 161Band the data management information in the one or more storage devices131.

As described above, when the second communication-disabled state occurs,since the performance message and the write process start notificationdescribed above are received instead of a block command, the CTL 60B canbe prevented from being blocked.

After S419, the CTL 60B returns a write completion notificationconfirmation response (an example of a fifth signal) to the CTL 60A viathe command communication path 144 (S421). When the CTL 60A receives theconfirmation response, the CTL 60A blocks itself (S422). The CTL 60Areceiving the write completion notification confirmation responsecorresponds to the CTL 60A becoming cognizant of the fact that the CTL60B has started acceptance of I/O requests. Since the CTL 60A is blockedin such a case, at least one CTL 60 can be guaranteed to accept I/Orequests.

In addition, while the exchanges between the CTLs 60A and 60B in theprocesses shown in FIGS. 3 and 4 may be performed via the managementsystem 54, by performing the exchanges via the command communicationpath 144, faster exchanges than those performed via the managementsystem 54 can be expected.

In addition, whether or not to perform a shutdown-less replacement ofthe CTL 60A when the second communication-disabled state occurs isdetermined by the maintenance person. Accordingly, a situation where theCTL 60A enters a block state without confirmation by the maintenanceperson can be avoided.

While several embodiments have been described above, it is to beunderstood that the described embodiments merely represent examples forillustrating the present invention and that the scope of the presentinvention is not limited to the embodiments. The present invention canalso be implemented in various other modes. For example, in the datamanagement information 175, the data attribute 212 may include at leastone of an I/O frequency and a final I/O time point. After starting I/Oacceptance, the CTL 60B may predict, in the background (in other words,regardless of whether or not an I/O request is accepted), data with ahigh read probability based on at least one of the I/O frequency and thefinal I/O time point in each entry and cache the predicted data from thestorage device 131 to the memory 161B. Accordingly, an improvement inread performance can be expected.

REFERENCE SIGNS LIST

-   104 Storage system

1. A storage system configured to be coupled to a host that issues I/O(Input/Output) requests, the storage system comprising: one or morestorage devices; first and second storage controllers which areredundant storage controllers and which are configured to be coupled tothe host and the one or more storage devices; and a data communicationpath which is coupled to the first and second storage controllers,wherein the first storage controller includes a first memory in whichdata in accordance with a write request received by the first storagecontroller is cached, the second storage controller includes a secondmemory in which data in accordance with a write request received by thesecond storage controller is cached, each of the first and secondmemories is configured to store data management information which ismanagement information related to data to be written into the one ormore storage devices in response to a write request, the datacommunication path is a path used in order to synchronize at least oneof dirty data and a management information update portion between thefirst and second storage controllers, the dirty data is data not yetwritten into the one or more storage devices from a memory, themanagement information update portion is at least a portion which isupdated in accordance with a write request in the data managementinformation, the second storage controller is blocked and replaced whena first communication-disabled state occurs in which communication viathe data communication path is disabled, and when a secondcommunication-disabled state occurs in which communication via the datacommunication path is disabled even after the second storage controlleris replaced, (A) the first storage controller is configured to execute awrite process of writing dirty data and data management information inthe first memory into the one or more storage devices while maintainingacceptance of I/O requests from the host; (B) the replaced secondstorage controller is configured to read the data management informationfrom the one or more storage devices to the second memory; (C) the firststorage controller is configured to stop accepting I/O requests from thehost; and (D) the replaced second storage controller is configured tostart accepting I/O requests from the host.
 2. The storage systemaccording to claim 1, wherein the second storage controller isconfigured to receive, when the first communication-disabled stateoccurs, a first signal which causes blockage of the second storagecontroller, and the replaced second storage controller is configured toreceive, when the second communication-disabled state occurs, a secondsignal which causes the data management information to be read from theone or more storage devices to the second memory instead of the firstsignal.
 3. The storage system according to claim 2, further comprising acommand communication path which is coupled to the first and secondstorage controllers, wherein the command communication path is a pathused to transmit and receive control commands between the first andsecond storage controllers, and the second storage controller isconfigured to receive the first signal and the second signal from thefirst storage controller via the command communication path.
 4. Thestorage system according to claim 3, wherein the replaced second storagecontroller is configured to: execute a preparation process includinginitial configuration for accepting I/O requests from the host; andtransmit, after completion of the preparation process, a third signal tothe first storage controller via the command communication path, and thefirst storage controller is configured to, when receiving the thirdsignal, start the write process and transmit the second signal to thesecond storage controller via the command communication path when thesecond communication-disabled state occurs.
 5. The storage systemaccording to claim 4, wherein the first storage controller is configuredto, after completion of the write process, transmit a fourth signal tothe second storage controller via the command communication path andexecute the (C), and the second storage controller is configured toexecute the (D) after receiving the fourth signal.
 6. The storage systemaccording to claim 5, wherein the second storage controller isconfigured to transmit a fifth signal to the first storage controllervia the command communication path when (D) is executed, and the firststorage controller is configured to block itself when receiving thefifth signal.
 7. The storage system according to claim 3, wherein priorto the occurrence of the second communication-disabled state, the firststorage controller has a role of a master configured to transmit thefirst signal for blocking a storage controller having a role as a slavewhen the first communication-disabled state occurs, and the secondstorage controller has a role as a slave, the (C) corresponds to a stopof the role as a master of the first controller, and the (D) correspondsto a start of the role as a master of the replaced second storagecontroller.
 8. The storage system according to claim 1, wherein thefirst storage controller and the replaced second storage controller arecoupled to a management system of the storage system, and when thesecond communication-disabled state occurs, the first storage controllerare configured to transmit a first message to the management system, andthe (A) is started when at least one of the first storage controller andthe replaced second storage controller receives a second message fromthe management system which received the first message.
 9. The storagesystem according to claim 1, wherein in the (A), the first storagecontroller is configured to write, when receiving a write request fromthe host, data in accordance with the write request into the one or morestorage devices and update the data management information in the one ormore storage devices in accordance with the writing of data andsubsequently respond to the host with a write completion.
 10. A storagecontrol method of a storage system including first and second storagecontrollers which are redundant storage controllers and which arecoupled to a host that issues I/O (Input/Output) requests and to one ormore storage devices, the method comprising: blocking and replacing thesecond controller when a first communication-disabled state occurs inwhich communication via a data communication path is disabled, the datacommunication path being a path connected to the first and secondstorage controllers, the first storage controller including a firstmemory in which data in accordance with a write request received by thefirst storage controller is cached, the second storage controllerincluding a second memory in which data in accordance with a writerequest received by the second storage controller is cached, each of thefirst and second memories storing data management information which ismanagement information related to data to be written into the one ormore storage devices in response to a write request, the datacommunication path being a path used in order to synchronize at leastone of dirty data and a management information update portion betweenthe first and second storage controllers, the dirty data being data notyet written into the one or more storage devices from a memory, themanagement information update portion being at least a portion which isupdated in accordance with a write request in the data managementinformation, and when a second communication-disabled state occurs inwhich communication via the data communication path is disabled evenafter the second storage controller is replaced: (A) the first storagecontroller executing a write process of writing dirty data and datamanagement information in the first memory into the one or more storagedevices while maintaining acceptance of I/O requests from the host; (B)the replaced second storage controller reading the data managementinformation from the one or more storage devices to the second memory;(C) the first storage controller stopping accepting I/O requests fromthe host; and (D) the replaced second storage controller startingaccepting I/O requests from the host.